GitHub Advisoryadvisory · NuGet

GHSA-xxc6-35r7-796w Possible injection of HTML into user invite mails

LOW Published 2023-12-13 Modified 2024-01-12 Official page ↗
Aliases
CVE-2023-38694
Ecosystem
NuGet
Packages
Umbraco.CMS
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N
Weaknesses
CWE-79
Reviewed
2023-12-13

Affected packages

• NuGet Umbraco.CMS: >= 8.0.0, < 8.18.10 → fixed in 8.18.10 • NuGet Umbraco.CMS: >= 9.0.0, < 10.7.0 → fixed in 10.7.0 • NuGet Umbraco.CMS: >= 11.0.0, < 12.1.0 → fixed in 12.1.0

Description

Impact A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Explanation of the vulnerability A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message.

Related

Alias · CVE (1)

  • CVE-2023-38694 Umbraco is an ASP.NET content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References